214 matches found
Astra Linux – Vulnerability in ffmpeg
In FFmpeg 4.4, the file libavcodec/dnxhddec.c does not check the return value of the initvlc function. This is a similar issue to CVE-2013-0868...
Astra Linux – Vulnerability in ffmpeg
In FFmpeg 4.4, the adtsdecodeextradata function in libavformat/adtsenc.c does not check the return value of initgetbits. This is a necessary step, as the second argument of initgetbits can be manipulated...
ROOT-OS-UBUNTU-2404-CVE-2025-21820 CVE-2025-21820 in linux - Patched by Root
Root has patched CVE-2025-21820 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2404-CVE-2026-53140 CVE-2026-53140 in linux - Patched by Root
Root has patched CVE-2026-53140 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
CLSA-2026-1777509609 TuxCare security update for spatie/browsershot (5 CVEs)
TuxCare rebuilt spatie/browsershot to address 5 CVEs. Fixed in 4.4.0-p2+tuxcare...
CVE-2026-54735
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...
prebid-server's request forgery vulnerability allows for possible host environment data extraction
Impact Certain bidder adapters accept user-supplied parameters that are interpolated into outbound request URLs. Without proper input validation, a malicious actor could craft bid request parameters that cause the server to send HTTP requests to unintended destinations, potentially exposing...
CVE-2026-54735 prebid-server's request forgery vulnerability allows for possible host environment data extraction
Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...
PT-2026-64938
Unauthenticated SQL Injection in AWP Classifieds = 4.4.7 versions...
Linux Distros Unpatched Vulnerability : CVE-2026-64832
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg versions 4.4 through 8.1.2 contain a double-free vulnerability in the NVIDIA NVDEC hardware decoder within libavcodec/nvdec.c that allows attackers to...
CVE-2026-65536 WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in افزونه حمل و نقل ووکامرس پست پیشتاز و سفارشی، پیک موتوری = 4.4.5 versions...
CVE-2026-11990 KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint
The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...
CVE-2026-15164 Heap-based Buffer Overflow in ciscodump
Crash in ciscodump 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service...
PT-2026-56326
The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter in all versions up to, and including, 4.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
PT-2026-55927
Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5...
Zebra has sync restart poisoning from single unauthenticated peer via above-lookahead block
Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections and is syncing or catching up to the chain tip. Summary A malicious peer can answer Zebra's outbound getblocks/FindBlocks request with a small two-hash inventory, then ser...
GHSA-H72H-PPCX-998P Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length
Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections network.listenaddr is set, which is the default. Summary The P2P codec's Codec::decode method calls src.reservebodylen + HEADERLEN after parsing a 24-byte protocol header,...
PT-2026-55479
Name of the Vulnerable Software and Affected Versions ZEBRA versions prior to 4.5.0 Description An address normalization mismatch between the handshake path and the mempool misbehavior path allows an unauthenticated IPv4 peer to deterministically crash a synced Zebra node. This occurs when a node...
CVE-2026-10653
The Zephyr netbuf library lib/netbuf/buf.c manipulated both of its reference counts -- the per-header buf-ref and the per-data-block refcount at the start of each variable/heap data allocation -- with plain non-atomic C operators buf-ref++, if --buf-ref 0, if --refcount. The API is documented as...
